io.qameta.allure:allure-generator 2.32.2

Direct Vulnerabilities

Known vulnerabilities in the io.qameta.allure:allure-generator package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the `Allure2Plugin` and `Allure1Plugin` description HTML handling, and through `CategoriesPlugin` category description HTML in the report aggregation components. An attacker can inject malicious HTML or JavaScript by supplying crafted `descriptionHtml` or category `descriptionHtml` content in Allure results files, causing the report viewer to execute an attacker-controlled script when the report is opened. This lets an attacker run a script in the user's browser in the context of the generated report, exposing report data and enabling actions as the victim within the report UI. How to fix Cross-site Scripting (XSS)? Upgrade `io.qameta.allure:allure-generator` to version 2.39.0 or higher.	[,2.39.0)
C Directory Traversal Affected versions of this package are vulnerable to Directory Traversal due to using `Path.resolve()` function without normalizing the path or checking if the resulting file remains within the intended results directory. An attacker can access sensitive files on the host system by crafting a malicious result file that references arbitrary file paths, causing these files to be included in the generated report. How to fix Directory Traversal? Upgrade `io.qameta.allure:allure-generator` to version 2.38.0 or higher.	[,2.38.0)

Vulnerability

Vulnerable Version

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the Allure2Plugin and Allure1Plugin description HTML handling, and through CategoriesPlugin category description HTML in the report aggregation components. An attacker can inject malicious HTML or JavaScript by supplying crafted descriptionHtml or category descriptionHtml content in Allure results files, causing the report viewer to execute an attacker-controlled script when the report is opened. This lets an attacker run a script in the user's browser in the context of the generated report, exposing report data and enabling actions as the victim within the report UI.

How to fix Cross-site Scripting (XSS)?

Upgrade io.qameta.allure:allure-generator to version 2.39.0 or higher.

[,2.39.0)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal due to using Path.resolve() function without normalizing the path or checking if the resulting file remains within the intended results directory. An attacker can access sensitive files on the host system by crafting a malicious result file that references arbitrary file paths, causing these files to be included in the generated report.

How to fix Directory Traversal?

Upgrade io.qameta.allure:allure-generator to version 2.38.0 or higher.

[,2.38.0)

io.qameta.allure:allure-generator@2.32.2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically